Slackware: unzip directory traversal vulnerability
Posted by LinuxSecurity.com Team   
Slackware These fix a security issue where a specially crafted archive mayoverwrite files (including system files anywhere on the filesystem)upon extraction by a user with sufficient permissions.

[slackware-security]  unzip vulnerability patched (SSA:2003-237-01)

Upgraded infozip packages are available for Slackware 9.0 and -current.
These fix a security issue where a specially crafted archive may
overwrite files (including system files anywhere on the filesystem)
upon extraction by a user with sufficient permissions.

For more information, see:
 
http://www.securityfocus.com/bid/7550 
http://lwn.net/Articles/38540/ 
http://xforce.iss.net/xforce/xfdb/12004 
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0282


Here are the details from the Slackware 9.0 ChangeLog:
+--------------------------+
Mon Aug 25 15:35:28 PDT 2003
patches/packages/infozip-5.50-i486-2.tgz:  Fixed a bug where a specially
  crafted archive might try to write to ../ or ../../, etc, potentially
  overwriting system files if the user (such as root) has permissions to
  overwrite them.  Thanks to jelmer for locating this problem, and
  Ben Laurie for providing a patch.
  (* Security fix *)
+--------------------------+



WHERE TO FIND THE NEW PACKAGES:
+-----------------------------+

Updated package for Slackware 9.0: 
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/infozip-5.50-i386-2.tgz

Updated package for Slackware -current: 
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/a/infozip-5.50-i486-2.tgz



MD5 SIGNATURES:
+-------------+

Slackware 9.0 package:
d262ae0564f475b39e2ccf20fe1dfc41  infozip-5.50-i386-2.tgz

Slackware -current package:
8c4b4fc48e145a71e962cd7f99be8a5b  infozip-5.50-i486-2.tgz



INSTALLATION INSTRUCTIONS:
+------------------------+

Upgrade using upgradepkg (as root):
upgradepkg infozip-5.50-i386-2.tgz



+-----+

Slackware Linux Security Team 
http://slackware.com/gpg-key
security@slackware.com